Contents
Who are the users of partially contained databases?
Contained databases support two types of users: Windows users and groups that can directly connect to the database and do not need logins, and users with a password where the password is authenticated by the database, not the instance.
Can a contained database be authenticated by a password?
SQL Server includes the ability to determine when the containment boundary is crossed. There are two types of users for contained databases. Contained database users with passwords are authenticated by the database.
When does password complexity policy apply to SQL Server?
The password expiration and policy enforcement sections do not apply to SQL Database. Password complexity policies are designed to deter brute force attacks by increasing the number of possible passwords. When password complexity policy is enforced, new passwords must meet the following guidelines:
When does SQL Server enforce the password expiration policy?
When SQL Server enforces password expiration policy, users are reminded to change old passwords, and accounts that have expired passwords are disabled. The enforcement of password policy can be configured separately for each SQL Server login.
What to do if SQL Server is partially contained?
To mitigate this threat, restrict access to the database files, or only permit connections to contained databases by using Windows Authentication. If a database is partially contained, SQL Server administrators should periodically audit the capabilities of the users and modules in contained databases.
How to prevent a database from being contained?
To prevent any databases from being contained, set the Database Engine contained database authentication option to 0. To prevent connections by contained database users with passwords on selected contained databases, use login triggers to cancel login attempts by contained database users with passwords.